Modern businesses make use of a dizzying number of services and applications in day-to-day operation. Requiring employees to maintain multiple authentication credentials for these services and applications would result in crippling inconveniences and inefficiencies.
To address this issue, identity providers (IdP) were developed. Identity providers maintain identity information for service users and enable that information to be used for authenticating users with multiple service providers (SP). As a result, identity providers allow users to access many services and applications with a single set of credentials.
The tradeoff to the convenience of an IdP is that compromise of the IdP allows an attacker access to all of the services and applications linked to the IdP. Two-factor authentication (2FA) can be used to reduce the likelihood of compromise of individual credentials used to authenticate with the IdP. Unfortunately, in current security architectures, 2FA cannot help prevent unauthorized access if the IdP itself is compromised—full trust resides with the IdP. Thus, there is a need in the authentication field to create a new and useful method for distributed trust authentication. This invention provides such a new and useful system and method.